Legal
Privacy policy
What OnlyCRM collects, why we have it, who else sees it, how long we keep it, and how to get it back or have it erased.
The one distinction that explains the rest
OnlyCRM is software that businesses use to manage their own customers. That means there are two different kinds of information here, and we have a different role for each.
- Our customers. A clinic, an agency, a campaign. We decide what to collect about them in order to run the service and bill for it, so for this information we are the Data Fiduciary — the party answerable to you under the Digital Personal Data Protection Act, 2023.
- Our customers' customers. The people whose enquiries, cases and documents our customers store here. We do not decide what is collected about those people or why. We hold it on our customer's instructions, so for that information we are a Data Processor, and the business you dealt with is the one answerable to you.
If you filled in a form on some business's website or Facebook page and want your details removed, the fastest route is to ask that business directly — they can erase you from their workspace in one action. If you do not know who to ask, or they do not respond, write to us and we will act.
1. What we collect, and why
If you have an account with us
| What | Why we have it |
|---|---|
| Your name, email address, phone number and password | To create your account, sign you in, and reach you about it. The password is stored only as a one-way hash — we cannot read it, and nor can anyone who obtains the database. |
| Your organisation's name, trade, timezone, currency and plan | To set up your workspace with the right vocabulary and fields, and to bill the right amount. |
| Sign-in history: the time, the result, your IP address and browser | Security. This is how you find out somebody else tried to get into your account, and how we investigate when they succeed. Recorded for failed attempts as well as successful ones. |
| An audit trail of changes made in your workspace | Accountability — who changed what, when, and from where. Because it records the before and after of each change, it necessarily contains copies of the data that changed. |
| Support conversations | To answer you, and to remember what was said last time. |
| Invoices and payment records | To bill you and to keep the accounts. See Payments for what does not reach us. |
If you enquired about buying OnlyCRM
The contact form on our home page asks for your name and phone number, and optionally your email, organisation, trade and message. We use it to reply to you. It is stored as an enquiry in our own workspace and is subject to the same retention rules as anything else.
If a business stores your details in their OnlyCRM workspace
We hold whatever that business puts in, which typically includes your name, phone numbers, email, city, the enquiry you made, notes staff have written about their conversations with you, documents they attached, and — depending on the trade — answers to fields specific to it.
Some of those fields can be sensitive. A healthcare facilitator's workspace may hold a medical condition and a treatment; an insurance advisor's may hold a date of birth; a campaign's may hold political or community affiliation. We do not choose these fields and we do not use this information for any purpose of our own. The business that collected it decided to, and is answerable for having done so.
2. Our lawful basis
For account holders, we process your data to perform the contract you entered into with us, to comply with tax and accounting law, and — for the security logging above — on the basis of our legitimate interest in keeping accounts from being broken into. We do not sell data, we do not share it for advertising, and we do not build profiles of you.
For the people our customers store here, the lawful basis is the customer's to establish, not ours. The product gives them tools to do it: consent can be recorded per purpose — contact, marketing, data sharing, and where relevant health processing — with the date, the staff member who recorded it, and optionally a signature. Marketing and data-sharing default to refused until a consent record exists, which is the conservative way round.
3. Facebook and Instagram lead ads
If a customer connects their Facebook or Instagram account, we receive the enquiries people submit on their lead forms and file them in their workspace. Connecting is entirely optional and is done by the customer, from their own settings screen.
What we ask Meta for
When a customer connects, Facebook asks them to approve exactly these, and nothing else:
| Permission | What we do with it |
|---|---|
pages_show_list |
Show the customer a list of their own Facebook Pages so they can choose which ones send enquiries here. |
pages_manage_metadata |
Subscribe the Pages they chose to lead notifications, and unsubscribe them when they disconnect. We read and change nothing else about the Page. |
leads_retrieval |
Read the answers a person submitted on the customer's lead form, so it becomes an enquiry in their workspace. |
business_management |
Group the customer's Pages by Business Manager, so somebody administering many Pages can find the right ones. |
What we cannot do
We cannot post anything, read messages or comments, see a friends list, view ad spend, or access anything on a personal profile. The permissions above are the whole of our access, and Facebook enforces that independently of us.
What we store
The lead's answers, and — so a customer can tell a quarter later which advertisement worked — the campaign, ad set and ad, recorded by name as well as by id. The access tokens Facebook issues are encrypted at rest, never shown in any screen, and never written to a log. Disconnecting stops new enquiries arriving and unsubscribes the Pages at Meta; enquiries already received stay in the customer's workspace, because they are that business's records.
4. WhatsApp and Telegram
A customer may connect WhatsApp Business or a Telegram bot to receive enquiries and reply to them. Where they do, the message text and the sender's number or chat id pass through Meta's or Telegram's servers, under those companies' own terms, and are stored in the customer's workspace as part of the conversation history. Neither is enabled by default.
5. Payments
No card number, CVV, expiry date, bank account number or UPI PIN ever reaches our servers.
Subscription payments are taken through Razorpay. When you pay, the card form is served and rendered by Razorpay inside a frame this application cannot read. We create an order on our side carrying the amount and the invoice number, and what comes back to us is an order id, a payment id and a signature we verify. Your name and email address are passed to Razorpay so the receipt reaches you. Razorpay processes that payment under its own privacy policy.
We keep the invoice, the amount, the date and the payment reference, because tax law requires it.
6. The mobile app
The OnlyCRM Android app is the same account on a phone. It is built to keep working with no signal, which means it holds a copy of some of your work on the device.
- It asks for one permission: internet access. No camera, no location, no microphone, no storage, no contacts.
- It never reads your phone's contact book. The call, WhatsApp, SMS and email buttons hand the number to the app you already use; nothing is read back.
- It contains no analytics, advertising or crash-reporting SDK. No Firebase, no Google Analytics, no Meta SDK, nothing of that kind — on the phone or on the web.
- What it caches is encrypted by the phone's own keystore — your sign-in token, your task list, and the records you actually opened. It is capped in size, kept separately per user and per workspace, and signing out clears it.
- Work done offline waits in an outbox on the device and is sent when the signal returns.
9. When our staff can see a workspace
Support sometimes needs to see what a customer is seeing. Rather than ask people to email screenshots, an administrator on our side can open a support session into a workspace. We would rather tell you exactly how that is fenced than leave you to guess:
- It is read-only. The workspace becomes non-editable for the duration; there is no route by which our staff change a customer's record.
- It expires after thirty minutes, re-checked on every request.
- A written reason is required before it can start.
- It is recorded in your own audit trail, not ours — with who, when, why, and when it ended. Settings → Audit trail shows every one of them.
- Stored credentials stay hidden during the session.
There is no facility to log in as one of your users, and no way for our staff to read a password — we do not hold one in readable form.
10. How long we keep things
These are the platform defaults. A customer can set shorter periods for their own workspace in Settings → Data retention, and the shorter one wins.
| What | Kept for | Then |
|---|---|---|
| Raw form submissions as they arrived | 90 days | The personal content is stripped out. The record that a submission happened stays, so capture reporting remains accurate. |
| Uploaded spreadsheets used for imports | 30 days | The file is deleted from disk. The import's counts stay. |
| Records a customer deleted | 30 days | Undo window. After it, the record is erased in full. |
| The audit trail | 2 years | Deleted. Long, because it is the accountability record — but not forever, because it contains copies of what changed. |
| Sign-in history | 1 year | Deleted. |
| Closed enquiries — won or lost | Kept until the customer says otherwise | Off by default. This is the one setting that destroys business records, so it is a decision a customer makes rather than one they inherit. |
Backups are kept on a shorter rolling cycle and are overwritten in turn; a record erased from the live system may persist in a backup until that backup ages out. Backups are not used to answer queries or restore individual records.
11. Your rights, and how to use them
Under the DPDP Act 2023 you may ask for the following. We answer within 30 days and charge nothing.
- A copy of what we hold about you. Account holders can also export any individual record from the product as a JSON file.
- Correction of anything inaccurate or incomplete.
- Erasure. See the note below on what erasure actually does.
- To withdraw consent you previously gave, as easily as you gave it.
- To nominate someone to exercise these rights on your behalf if you die or become incapable.
- To complain — to our Grievance Officer first, and to the Data Protection Board of India if we do not resolve it.
What erasure actually does, stated plainly
Erasing a person removes every identifying detail — name, phone numbers,
email, city, notes, attachments, the raw submission, the case and its line
items, and the audit trail's copies of all of it. The name is replaced with
[erased].
What survives is a shell with no identity in it: the reference number, the dates, which channel it came from, which stage it reached, and any money figure. That is deliberate. Deleting the row outright would silently change the business's historical totals — last year's revenue would move — and a customer discovering that would reasonably stop trusting every other number in the system. Nothing in what remains identifies you.
We also record that an erasure happened, so we can prove we did it. That record identifies the subject only by a one-way hash — it cannot be turned back into your phone number or email.
12. How it is protected
- Traffic is encrypted in transit with TLS, and browsers are instructed to refuse an unencrypted connection.
- Passwords are stored as one-way hashes, never in readable form. A minimum length is enforced, and sign-in attempts are rate-limited.
- Credentials the product holds on a customer's behalf — Facebook access tokens, mail server passwords, payment gateway secrets — are encrypted in the database and excluded from every screen, export and log.
- Every workspace's data is isolated at the database query layer, and that isolation fails closed: if the system cannot establish whose workspace a request belongs to, the query returns nothing rather than everything.
- Uploaded files are stored privately under randomised names, never under the name they were uploaded with.
- The application sends a strict content security policy and disables framing, content-type sniffing and browser tracking features.
Personal data in the CRM itself is not separately encrypted at the application layer; it is protected by the access controls, the transport encryption and the security of the server. We are telling you this rather than implying otherwise. If we become aware of a breach affecting your data, we will notify you and the Data Protection Board as the Act requires.
13. Children
OnlyCRM is a business tool. Accounts are for people acting for a business, and we do not knowingly create one for anybody under 18. There is no age gate at sign-up, so if you believe a child has created an account, tell us and we will remove it.
Separately: a customer's workspace may legitimately contain information about children — a paediatric clinic's patients, a welfare organisation's beneficiaries. That data belongs to the business that collected it, and the obligation to obtain a parent's consent is theirs. Requests about a child's data should go to that business, or to us if you cannot reach them.
14. Changes to this policy
When this policy changes, the date at the top changes with it. Where a change materially affects how we handle your data, we will email account holders before it takes effect rather than relying on you to re-read the page.
15. Contact and grievances
- Operated by
- Vedagni Engineers Pvt. Ltd.
- Registered address
- Address to be published — write to the email below and we will provide it.
- Privacy enquiries
- appsnow.in@gmail.com
- Grievance Officer
- appsnow.in@gmail.com
If we do not resolve your grievance to your satisfaction, you may complain to the Data Protection Board of India.